Gentoo Linux Security Advisory 201606-5 - Multiple vulnerabilities have been found in spice, the worst of which may result in the remote execution of arbitrary code. Versions less than 0.12.7-r1 are affected.
1d66db877a2f969ac356bd3b70ccfafe3d4d009d836c4386f20de29ce0e797cfRed Hat Security Advisory 2015-1890-01 - The Simple Protocol for Independent Computing Environments is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtualized guests running on the Kernel-based Virtual Machine hypervisor or on Red Hat Enterprise Virtualization Hypervisors. A heap-based buffer overflow flaw was found in the way SPICE handled certain guest QXL commands related to surface creation. A user in a guest could use this flaw to read and write arbitrary memory locations on the host.
2419a1f8bb197d011605571f9eff7d3803265fff612609c2b582203ccbbe7645Red Hat Security Advisory 2015-1889-01 - The Simple Protocol for Independent Computing Environments is a remote display protocol for virtual environments. SPICE users can access a virtualized desktop or server from the local system or any system with network access to the server. SPICE is used in Red Hat Enterprise Linux for viewing virtualized guests running on the Kernel-based Virtual Machine hypervisor or on Red Hat Enterprise Virtualization Hypervisors. A heap-based buffer overflow flaw was found in the way SPICE handled certain guest QXL commands related to surface creation. A user in a guest could use this flaw to read and write arbitrary memory locations on the host.
4e0726057f796adcd2fcb126eb4b00d2f42baf185d0c4b84693cbae4e4b50be8Debian Linux Security Advisory 3371-1 - Frediano Ziglio of Red Hat discovered several vulnerabilities in spice, a SPICE protocol client and server library. A malicious guest can exploit these flaws to cause a denial of service (QEMU process crash), execute arbitrary code on the host with the privileges of the hosting QEMU process or read and write arbitrary memory locations on the host.
8724adae44c0f76d42a3f5b53969d8f1a2b8410728271b1ae7c84ec133ccef00Ubuntu Security Notice 2766-1 - Frediano Ziglio discovered multiple buffer overflows, undefined behavior signed integer operations, race conditions, memory leaks, and denial of service issues in Spice. A malicious guest operating system could potentially exploit these issues to escape virtualization.
06330da6f524f8e255016d7efcef7001c938f28a2426dbd3cfe9ce05bf56cbae
© 2024 Packet Storm. All rights reserved.
%7Cutmcsr%3D(direct)%7Cutmcmd%3D(none)){kind=small}
Follow us on Twitter
Follow us on Facebook
Subscribe to an RSS Feed